binarybeach/bb-plane-fork
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: Member Information Disclosure via Public Endpoint #8646

Browse source
This commit is contained in:
sriram veeraghanta 2026-02-20 18:33:45 +05:30 • committed by sriramveeraghanta
parent a77af4e67e
commit 8c23fdd1d8
3 changed files with 8 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

10
apps/api/plane/space/views/project.py
View file

@ -63,6 +63,11 @@ class ProjectMembersEndpoint(BaseAPIView):
def get(self, request, anchor): def get(self, request, anchor):
deploy_board = DeployBoard.objects.filter(anchor=anchor).first() deploy_board = DeployBoard.objects.filter(anchor=anchor).first()
if not deploy_board:
return Response(
{"error": "Invalid anchor"},
status=status.HTTP_404_NOT_FOUND,
)
members = ProjectMember.objects.filter( members = ProjectMember.objects.filter(
project=deploy_board.project, project=deploy_board.project,
@ -71,10 +76,7 @@ class ProjectMembersEndpoint(BaseAPIView):
).values( ).values(
"id", "id",
"member", "member",
"member__first_name",
"member__last_name",
"member__display_name", "member__display_name",
"project", "member__avatar",
"workspace",
) )
return Response(members, status=status.HTTP_200_OK) return Response(members, status=status.HTTP_200_OK)

6
apps/space/core/types/member.d.ts vendored
View file

@ -1,10 +1,6 @@
export type TPublicMember = { export type TPublicMember = {
id: string; id: string;
member: string; member: string;
member__avatar: string;
member__first_name: string;
member__last_name: string;
member__display_name: string; member__display_name: string;
project: string; member__avatar: string;
workspace: string;
}; };

6
packages/types/src/users.ts
View file

@ -196,12 +196,8 @@ export type TProfileViews = "assigned" | "created" | "subscribed";
export type TPublicMember = { export type TPublicMember = {
id: string; id: string;
member: string; member: string;
member__avatar: string;
member__first_name: string;
member__last_name: string;
member__display_name: string; member__display_name: string;
project: string; member__avatar: string;
workspace: string;
}; };
// export interface ICurrentUser { // export interface ICurrentUser {